Cannot parsing when using \t tokenizer

----------------------- Option ---------------------------------
custom_patterns = “TEST_TIMESTAMP %{YEAR}/%{MONTHDAY}/%{MONTHNUM},%{TIME}”
patterns = [’%{TEST_TIMESTAMP:timestamp:ts-“2006/02/01,15:04:05”}\t%{WORD:value}’]

----------------------------Log Sample--------------------------------------------------------------

2018/03/13,10:54:47 POST

i recieve message this ( 2018-04-26T00:33:00Z D! Grok no match found for: “2018/03/13,10:54:47\tPOST” )

can you help me??

If you use a single quote string in the TOML then most of the escape sequences are disabled, so '\t' matches a literal backslash followed by t, not a tab character. Maybe switch to using triple quote: """?

Details are here:

1 Like

thank you. i was done this issue